Skip to content

Conversation

@rezmoss
Copy link
Contributor

@rezmoss rezmoss commented Jan 6, 2026

Description

fixed #4529, parse and detect old bitnami img pkgs

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (please discuss with the team first; Syft is 1.0 software and we won't accept breaking changes without going to 2.0)
  • Documentation (updates the documentation)
  • Chore (improve the developer experience, fix a test flake, etc, without changing the visible behavior of Syft)
  • Performance (make Syft run faster or use less memory, without changing visible behavior much)

Checklist

  • I have added unit tests that cover changed behavior
  • I have tested my code in common scenarios and confirmed there are no regressions
  • I have added comments to my code, particularly in hard-to-understand sections

Issue references

Signed-off-by: Rez Moss <hi@rezmoss.com>
…abilitirs.yml

Signed-off-by: Rez Moss <hi@rezmoss.com>
Copy link
Contributor

@kzantow kzantow left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

"/opt/bitnami/**/.spdx-*.spdx",
).
WithParserByGlobs(parseComponentsJSON,
"/opt/bitnami/.bitnami_components.json",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is this always at /opt/bitnami/..? I guess we can always start specific and if needed make this a glob search 👍

"",
).String()

metadata := &pkg.BitnamiSBOMEntry{
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Generally, we try to have metadata types that are very specific to the source material, and the SBOMEntry part makes this a little misleading, since these component definitions don't seem to be SBOMs, exactly. But if we made a different type it would be almost identical anyway, so this seems good to me (team agreed), just noting it.

@kzantow kzantow merged commit 7f1d57d into anchore:main Jan 7, 2026
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

old bitnami images without spdx files arent getting picked up correctly in the catalog

2 participants